SYSVOL and NETLOGON Share is missing in Newly Built Domain Controllers

I recently provisioned a new Domain Controller, running Server 2016.  

After joining to domain, adding the AD roles and then promoting to DC, I noticed the NETLOGON and SYSVOL folders were missing.  Not just the shares, but the actual folders themselves.

Luckily, I was able to fix this rather easily, by following these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate the following subkey in Registry Editor:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
3. In the details pane, right-click the SysvolReady flag, and then click Modify.
4. In the Value data box, type 0, and then click OK.
5. Again in the details pane, right-click the SysvolReady flag, and then click Modify.
6. In the Value data box, type 1, and then click OK.

Once this is done, you simply have to stop and start the netlogon service.

• Net Stop Netlogon
• Net Start Netlogon

Reset NTFS Permissions | Export & Import Existing Permissions

I recently encountered a newly installed File Server which had some busted NTFS on it.  The file permissions had been copied over from the old File Server, and whilst they looked like they applied well, it was causing some issues accessing files etc.

I decided it was time to completely refresh the permissions on all the folders and sub-folders, to ensure that they applied correctly.

To do this, there's three steps which need to be taken.

1. Export the existing NTFS permissions
2. Reset permissions
3. Restore old permissions

This is actually quite a simple task to do, and can be done by using ICACLS.  The following guide will explain how this can be done. 

1. Open PowerShell as Admin (you can also do this within an Administrative command prompt)

2. Run the following command:

icacls C:\TEMP\* /save "C:\Temp\AclFile.txt" /T /C

The part in bold is the 'source' of your NTFS permissions.  Selecting "/T" at the end ensures it goes through all the sub-folders as well to copy the permissions of them.

3. Run the following command to reset the permissions:

icacls C:\Temp\* /reset /T /C /L

The part in bold is the 'source' of your NTFS permissions.

4. Restore the permissions by using the following command:

icacls C:\Temp /restore "C:\Temp\AclFile.txt" /T /C

The part in bold is the 'target' of your NTFS permissions.

Note: before doing anything changes to permissions on a File Server, make sure you have either a working backup, or you've recently snapshotted the server. 

/T - Traverse all subfolders to match files/directories. This will apply permission changes to all subfolders whether or not they are set to inherit permissions from the parent. On very large directory structures this may take some time as the command has to traverse the entire tree. /C - Continue on file errors (access denied) Error messages are still displayed. /L - Perform the operation on a symbolic link itself, not its target.

Setup DC for time sync to external NTP server

The following steps can be taken to force your Domain Controller to sync with an external NTP server.

Run CMD as Administrator

net stop w32time

w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org" /reliable:yes /update

net start w32time

Stop Server Manager from showing at logon | RDS

I recently configured a new RDS solution for a client where Server Manager was always popping up when logging in.  I didn't want this to happen for users, so I needed to make the required registry change for this to no longer happen:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager

There should already be a DWORD called DoNotOpenServerManagerAtLogon which is set to Decimal: 0.  Simply change this over to Decimal: 1 (as opposed to Hexadecimal: 1) to stop this from happening again.

You will still be able to open up Server Manager, however this won't appear automatically when logging in.

If you require IT Support in the Perth area, contact Winthrop Australia

An Access-Request message was received from RADIUS client x.x.x.x with a Message-Authenticator attribute that is not valid

A client of mine recently had Enterprise Wireless (PEAP) wireless configured which connects to a NPS server to authenticate users connecting up.  People had issues connecting to the wireless after a new Domain Controller was brought online.

Checking the Event Logs, I found the following error:

This indicates that the Shared Secret between the Access Point and what's configured on the NPS (usually a DC) is not the same.  In order to get around this, I checked the settings of each Access Point and updated the Shared Secret.

Once you've done this, log into each access point and update the Shared Secret on to ensure that it's the same.  Once you've done this, the access points should communicate with the DC (or NPS) successfully.

Winthrop Australia provides IT Support in Perth.

Migrate DHCP Server to Server 2016

The following process can be followed when you're creating a new Domain Controller, and you'd like to migrate DHCP settings from an old DC to a new one.

I have done this from Server 2008R2 to Server 2016, however this can be used from 2008 to 2016.

1. Log in to the old (existing) Domain Controller running DHCP
2. Open up an Administrative Command Prompt
3. Type the following:
   netsh dhcp server export C:\Users\<username>\Desktop\dhcp.txt all
4. Copy the .txt file over to the desktop of the new DC
5. Open up an Administrative Command Prompt
6. Type the following:
   netsh dhcp server import C:\Users\<username>\Desktop\dhcp.txt all
7. Open DHCP on the new 2016 server.  You will notice all the settings have now been migrated (including reservations and leases)

Once you've done this, you will then need to authorise the new DC and unauthorise the old DC.  This should happen automatically when you authorise the new DC, however make sure you double check this on the old one. 

To be on the safe as once you've done this, make sure you disable the DHCP Server service on the old DC.  This will ensure it does not start again if you were to reboot the server.

If you require IT Support in Perth, contact Winthrop Australia